Vercel Launches Security Review Beta: AI Agents Scan and Fix Code Vulnerabilities on Push

US cloud development platform Vercel announced on November 2, 2026, the launch of "Security Review," a new capability within its AI agent product, Vercel Agent. Currently in public beta, the feature aims to address the growing bottleneck of code security reviews in the era of AI-assisted programming by integrating automated scanning and remediation into every code push.

The mechanism is triggered by GitHub push events. When developers submit code to repositories connected to Vercel projects, the AI agent immediately scans the changed parts (diffs) for vulnerabilities such as missing authorization checks or exposed secrets. Unlike traditional pattern-matching scanners, Vercel claims its agent reads surrounding context, traces code reachability, and identifies logic flaws. Findings appear as comments on Pull Requests and are aggregated in the Security dashboard.

Beyond detection, the feature emphasizes remediation. Users can click "Fix with Vercel Agent" in the dashboard, prompting the AI to verify the vulnerability, generate a minimal fix, and update tests. Teams can also define security policies in plain language (e.g., requiring all endpoints returning customer data to verify requester ownership), which are applied during each review. For enterprise users, each new finding generates an audit log event sendable to SIEM systems.

Vercel notes that as frontier AI models make it easier to find and exploit vulnerabilities, and as AI agents write more production code, traditional security review methods struggle to keep pace. Security Review currently supports code pushed to GitHub, with plans to extend to Vercel CLI deployments, v0, and non-Vercel hosted repositories. The feature is available for Pro and Enterprise teams, billed at the Vercel Agent rate, but free until November 10, 2026.